ace-herdr 0.4.0 → 0.5.0

data/lib/ace/herdr/molecules/inbox_context_client.rb

@@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_linux"
+require_relative "inbox_context_wire"
+require_relative "inbox_direct_result"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Constructor inputs come only from the verified installed context map.
+      class InboxContextClient
+        def self.selected(context_id:, socket_path:, owner_credentials:, **options)
+          new(context_id: context_id, socket_path: socket_path, owner_identity: nil,
+            owner_credentials: owner_credentials, **options)
+        end
+
+        def initialize(context_id:, socket_path:, owner_identity:, owner_credentials: nil, kernel: Ace::Runtime::Molecules::ProtectedLinux.new,
+          wire: Ace::Runtime::Molecules::ProtectedSocket)
+          @context_id, @socket_path, @identity, @kernel, @wire = context_id, socket_path, owner_identity, kernel, wire
+          @credentials = owner_credentials || owner_identity&.slice("uid", "gid", "groups")
+          unless @credentials.is_a?(Hash) && @credentials.keys.sort == %w[gid groups uid] &&
+              @credentials.values_at("uid", "gid").all? { |value| value.is_a?(Integer) && value.positive? } &&
+              @credentials["groups"].is_a?(Array) && @credentials["groups"].size <= 64 &&
+              @credentials["groups"].all? { |value| value.is_a?(Integer) && value.positive? } && @credentials["groups"] == @credentials["groups"].sort.uniq
+            raise ValidationError, "context fixed owner credentials differ"
+          end
+          @selection_mutex = Mutex.new
+        end
+
+        def request(operation, params, payload: nil)
+          if operation == "enqueue_context"
+            unless payload.is_a?(String) && payload.bytesize.between?(1, 65_536) &&
+                params["payload_bytes"] == payload.bytesize && params["payload_sha256"] == Digest::SHA256.hexdigest(payload)
+              raise ValidationError, "context payload differs"
+            end
+          elsif payload
+            raise ValidationError, "context operation does not accept payload"
+          end
+          @wire.root_path!(File.dirname(@socket_path), directory: true, owner: @credentials.fetch("uid"))
+          before = @wire.socket_identity(@socket_path)
+          raise ValidationError, "context socket owner differs" unless before[2] == @credentials.fetch("uid")
+          @kernel.live!(@identity) if @identity
+          deadline = InboxContextWire.deadline
+          @wire.connect(@socket_path, deadline: deadline) do |socket|
+            observed = @kernel.peer(socket)
+            unless observed.values_at("uid", "gid", "groups") == @credentials.values_at("uid", "gid", "groups")
+              raise ValidationError, "context fixed owner principal differs"
+            end
+            @selection_mutex.synchronize { @identity ||= JSON.parse(JSON.generate(observed)).freeze }
+            @kernel.live!(@identity)
+            unless @kernel.same?(@identity, observed) && @wire.socket_identity(@socket_path) == before
+              raise ValidationError, "context owner incarnation differs"
+            end
+            InboxContextWire.write(socket, {"version" => 1, "context_id" => @context_id,
+              "operation" => operation, "params" => params}, deadline: deadline)
+            if payload
+              # Same bounded writer; a one-part raw ingress has the larger native payload bound.
+              offset = 0
+              while offset < payload.bytesize
+                remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+                raise ValidationError, "context payload deadline expired" unless remaining.positive? && IO.select(nil, [socket], nil, remaining)
+                sent = socket.write_nonblock(payload.byteslice(offset..), exception: false)
+                next if sent == :wait_writable
+                offset += sent
+              end
+            end
+            socket.shutdown(Socket::SHUT_WR)
+            result = InboxContextWire.read(socket, deadline: deadline)
+            unless @kernel.same?(@identity, @kernel.peer(socket)) && @wire.socket_identity(@socket_path) == before
+              raise ValidationError, "context owner incarnation changed"
+            end
+            unless result.is_a?(Hash) && result["version"].is_a?(Integer) && result["version"] == 1 &&
+                result["context_id"] == @context_id && result.keys.sort == %w[context_id result version] && result["result"].is_a?(Hash)
+              raise ValidationError, "context operation is blocked or unverifiable"
+            end
+            data = result.fetch("result")
+            if %w[enqueue_context deliver_context status_context].include?(operation)
+              InboxDirectResult.verify!(data, operation: operation, event_id: params.fetch("event_id"), attempt_id: params.fetch("attempt_id"), original: params.fetch("original"))
+            end
+            data
+          end
+        rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError
+          raise ValidationError, "fixed context endpoint is unavailable"
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_context_completion_client.rb

@@ -0,0 +1,119 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_linux"
+require "ace/runtime/molecules/protected_socket"
+require_relative "inbox_direct_effect_binding"
+require_relative "guarded_native_origin"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Fixed installed authority selection; there is no caller-selected verifier
+      # callback, generic finished flag, current Inbox lookup or local fallback.
+      class InboxContextCompletionClient
+        LIMIT = 16_384
+
+        def initialize(authority:, project_id:, mapping_id:, kernel: Ace::Runtime::Molecules::ProtectedLinux.new,
+          wire: Ace::Runtime::Molecules::ProtectedSocket)
+          @authority, @project_id, @mapping_id, @kernel, @wire = authority, project_id, mapping_id, kernel, wire
+        end
+
+
+
+        # Identity evidence only: callers must independently own admission and
+        # exact native context/thread selection before any native effect.
+        def original!(assignment_id:, attempt_id:, event_id:, inbox_context_id:, purpose:, payload_sha256:)
+          params = {"mapping_id" => @mapping_id, "assignment_id" => assignment_id, "attempt_id" => attempt_id,
+            "event_id" => event_id, "inbox_context_id" => inbox_context_id, "purpose" => purpose,
+            "payload_sha256" => payload_sha256}
+          unless %w[assignment_id attempt_id event_id inbox_context_id mapping_id].all? { |key|
+              params[key].is_a?(String) && params[key].match?(/\A[A-Za-z0-9][A-Za-z0-9._-]{0,127}\z/) } &&
+              %w[enqueue deliver].include?(purpose) && %w[payload_sha256].all? { |key| (params[key].is_a?(String) && InboxDirectEffectBinding::SHA.match?(params[key])) }
+            raise ValidationError, "original context selection differs"
+          end
+          query!(operation: "inbox_context_original", params: params) { |data| verify_original!(data, params) }
+        end
+
+        private
+
+        def query!(operation:, params:)
+          path = @authority.fetch("socket_path")
+          @wire.root_path!(File.dirname(path), directory: true, owner: @authority.fetch("uid"))
+          endpoint = @wire.socket_identity(path)
+          raise ValidationError, "context completion authority endpoint differs" unless endpoint.last == @authority.fetch("uid")
+          deadline = @wire.deadline(30)
+          @wire.connect(path, deadline: deadline) do |socket|
+            original = @kernel.peer(socket)
+            unless original.values_at("uid", "gid", "groups") == @authority.values_at("uid", "gid", "groups") && @wire.socket_identity(path) == endpoint
+              raise ValidationError, "context completion authority principal differs"
+            end
+            @kernel.live!(original)
+            @wire.write(socket, {"version" => 1, "project_id" => @project_id, "operation" => operation,
+              "mutation_id" => nil, "params" => params}, deadline: deadline, limit: LIMIT)
+            socket.shutdown(Socket::SHUT_WR)
+            reply = @wire.read(socket, deadline: deadline, limit: LIMIT)
+            unless @kernel.same?(original, @kernel.peer(socket)) && @wire.socket_identity(path) == endpoint
+              raise ValidationError, "context completion authority incarnation changed"
+            end
+            @kernel.live!(original)
+            unless reply.is_a?(Hash) && reply.keys.sort == %w[data status transport] && reply["status"] == "ok" &&
+                reply["transport"] == {"replayed" => false}
+              raise ValidationError, "context completion canonical query refused"
+            end
+            yield reply.fetch("data")
+          end
+        rescue KeyError, TypeError, ArgumentError, Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+          raise ValidationError, "context canonical query is unavailable"
+        end
+
+        def verify_original!(data, params)
+          fields = %w[assignment_id attempt_id commit event_id guarded_origin inbox_context_id mapping_id native_binding native_channel original_binding_digest process_binding project_id purpose registered registration schema]
+          registration = params.slice("event_id", "attempt_id", "payload_sha256")
+          unless data.is_a?(Hash) && data.keys.sort == fields && data["schema"] == "ace.assign.inbox-context-original/v1" &&
+              data.slice("assignment_id", "attempt_id", "event_id", "inbox_context_id", "mapping_id", "purpose") ==
+                params.slice("assignment_id", "attempt_id", "event_id", "inbox_context_id", "mapping_id", "purpose") &&
+              data["project_id"] == @project_id && data["registration"] == registration &&
+              [true, false].include?(data["registered"]) && (params.fetch("purpose") != "deliver" || data["registered"]) &&
+              data["commit"].is_a?(String) && data["commit"].match?(/\A[0-9a-f]{40}\z/) &&
+              (data["original_binding_digest"].is_a?(String) && InboxDirectEffectBinding::SHA.match?(data["original_binding_digest"])) &&
+              data["process_binding"].is_a?(Hash) && data["native_binding"].is_a?(Hash)
+            raise ValidationError, "original context projection differs"
+          end
+          process = data.fetch("process_binding")
+          native = data.fetch("native_binding")
+          channel = data.fetch("native_channel")
+          path = channel["socket_path"] if channel.is_a?(Hash)
+          unless channel.is_a?(Hash) && channel.keys.sort == %w[socket_path version] && channel["version"] == "0.9.3" &&
+              path.is_a?(String) && path.valid_encoding? && path.bytesize.between?(1, 107) && path.start_with?("/") &&
+              !path.include?("\0") && File.expand_path(path) == path
+            raise ValidationError, "original context native channel differs"
+          end
+          origin = process["native_origin"]
+          unless process.keys.sort == %w[native_origin pane process_identity runtime session shell_identity terminal_id] &&
+              native.keys.sort == %w[scope_binding_event_id scope_generation server_identity service_invocation_id socket_identity workspace_id] &&
+              origin.is_a?(Hash) && origin.keys.sort == %w[command cwd pane server_identity socket_identity tab workspace] &&
+              process["runtime"] == "herdr" && process["shell_identity"] == process["process_identity"] &&
+              process["session"] == native["workspace_id"] && origin["workspace"] == process["session"] &&
+              origin["pane"] == process["pane"] && origin["server_identity"] == native["server_identity"] &&
+              origin["socket_identity"] == native["socket_identity"] && native["server_identity"].is_a?(Hash) &&
+              process.dig("process_identity", "parent_pid") == native.dig("server_identity", "pid")
+            raise ValidationError, "original context native association differs"
+          end
+          GuardedNativeOrigin.verify!(data.fetch("guarded_origin"), terminal_id: process.fetch("terminal_id"), child: process.fetch("process_identity"))
+          immutable(data)
+        end
+
+
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_context_key.rb

@@ -0,0 +1,63 @@
+# frozen_string_literal: true
+
+require "openssl"
+require "digest"
+require "ace/runtime/molecules/protected_artifact_set"
+require_relative "inbox_context_store"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Both fixed installer artifacts are read from held protected descriptors.
+      class InboxContextKey
+        LIMIT = 16_384
+        def initialize(context_id:, public_key_path:, config_path:, artifacts: Ace::Runtime::Molecules::ProtectedArtifactSet.new)
+          @context_id, @key_path, @config_path, @artifacts = context_id, public_key_path, config_path, artifacts
+        end
+
+        def snapshot = selected.fetch(:snapshot)
+
+        # The fresh verifier key and its metadata come from the same held pair.
+        # Rotation never leaves an Inbox collaborator pinned to an obsolete key.
+        def selected
+          @artifacts.with do |reader|
+            key_bytes, key_ref = reader.read_path!(@key_path, limit: LIMIT)
+            config_bytes, config_ref = reader.read_path!(@config_path, limit: LIMIT)
+            config = InboxContextStore.decode(config_bytes, limit: LIMIT)
+            unless config.is_a?(Hash) && config.keys.sort == %w[context_id key_generation public_key_sha256 schema] &&
+                config["schema"] == "ace.herdr.inbox-key/v1" && config["context_id"] == @context_id &&
+                config["key_generation"].is_a?(Integer) && config["key_generation"].between?(1, (1 << 63) - 1) &&
+                config["public_key_sha256"] == key_ref.fetch("sha256")
+              raise ValidationError, "installed context key configuration differs"
+            end
+            key = public_key!(key_bytes)
+            reader.verify_unchanged!
+            snapshot = {"key_generation" => config.fetch("key_generation"),
+              "fingerprint" => Digest::SHA256.hexdigest(key.public_to_der),
+              "public_key_sha256" => key_ref.fetch("sha256"), "config_sha256" => config_ref.fetch("sha256")}
+            {snapshot: snapshot.freeze, key: key.freeze}.freeze
+          end
+        rescue Ace::Runtime::RuntimeUnavailableError, OpenSSL::PKey::PKeyError, KeyError
+          raise ValidationError, "installed context key evidence is unavailable"
+        end
+
+        def self.public_key!(bytes)
+          unless bytes.is_a?(String) && bytes.bytesize.between?(1, LIMIT)
+            raise ValidationError, "context public key exceeds bounds"
+          end
+          key = OpenSSL::PKey.read(bytes)
+          unless key.is_a?(OpenSSL::PKey::RSA) && !key.private? && key.n.num_bits >= 2048
+            raise ValidationError, "context key must be public RSA"
+          end
+          key
+        rescue OpenSSL::PKey::PKeyError
+          raise ValidationError, "context public key is invalid"
+        end
+
+        private
+
+        def public_key!(bytes) = self.class.public_key!(bytes)
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_context_lifetime.rb

@@ -0,0 +1,122 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/execution_unit_installation"
+require "ace/runtime/molecules/cgroup_observation"
+require "ace/runtime/molecules/protected_linux"
+require_relative "inbox_context_service_configuration"
+
+module Ace
+  module Herdr
+    module Molecules
+      # An epoch is an observed service incarnation, not a caller grant. The
+      # full effective unit is verified before and after the pinned observation.
+      class InboxContextLifetime
+        EPOCH_FIELDS = %w[boot_id cgroup_identity installation_sha256 process_identity schema service_invocation_id service_unit].freeze
+        UUID = /\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/
+        class KernelFiles
+          def boot_id
+            bytes = File.read("/proc/sys/kernel/random/boot_id", 128).strip
+            unless bytes.match?(/\A[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\z/)
+              raise ValidationError, "context boot identity is unavailable"
+            end
+            bytes
+          rescue SystemCallError, IOError
+            raise ValidationError, "context boot identity is unavailable"
+          end
+        end
+
+        attr_reader :epoch
+
+        # Persisted shape validation alone never establishes stopped writers.
+        def self.validate_epoch!(epoch)
+          unless epoch.is_a?(Hash) && epoch.keys.sort == EPOCH_FIELDS && epoch["schema"] == "ace.herdr.inbox-owner-epoch/v1" &&
+              epoch["installation_sha256"].is_a?(String) && epoch["installation_sha256"].match?(/\A[0-9a-f]{64}\z/) &&
+              epoch["boot_id"].is_a?(String) && UUID.match?(epoch["boot_id"]) &&
+              epoch["service_invocation_id"].is_a?(String) && epoch["service_invocation_id"].match?(/\A[0-9a-f]{32}\z/) &&
+              epoch["service_unit"].is_a?(String) && epoch["service_unit"].match?(/\A[A-Za-z0-9_.@-]+\.service\z/)
+            raise ValidationError, "context epoch fields differ"
+          end
+          process = epoch.fetch("process_identity")
+          unless process.is_a?(Hash) && process.keys.sort == %w[gid groups host parent_pid pid started_at uid] &&
+              process.values_at("pid", "parent_pid").all? { |value| value.is_a?(Integer) && value.between?(1, (1 << 31) - 1) } &&
+              process.values_at("uid", "gid").all? { |value| value.is_a?(Integer) && value.between?(1, InboxContextServiceConfiguration::MAX_ID) } &&
+              process["groups"].is_a?(Array) && process["groups"].size <= 64 && process["groups"] == process["groups"].sort.uniq &&
+              process["groups"].all? { |value| value.is_a?(Integer) && value.between?(0, InboxContextServiceConfiguration::MAX_ID) } &&
+              process["host"].is_a?(String) && process["host"].bytesize.between?(1, 255) &&
+              process["started_at"].is_a?(String) && process["started_at"].match?(/\Alinux:#{Regexp.escape(epoch.fetch('boot_id'))}:[1-9][0-9]*\z/)
+            raise ValidationError, "context epoch process differs"
+          end
+          cgroup = epoch.fetch("cgroup_identity")
+          root = Ace::Runtime::Molecules::CgroupObservation::ROOT
+          unless cgroup.is_a?(Hash) && cgroup.keys.sort == %w[device filesystem_type inode mount_id path] &&
+              cgroup["filesystem_type"] == "cgroup2" && cgroup["path"].is_a?(String) &&
+              cgroup["path"].bytesize <= 4096 && !cgroup["path"].match?(/[\s\0]/) && cgroup["path"].start_with?(root + "/") &&
+              File.expand_path(cgroup["path"]) == cgroup["path"] &&
+              cgroup.values_at("device", "inode", "mount_id").all? { |value| value.is_a?(Integer) && value.between?(0, (1 << 64) - 1) } &&
+              JSON.generate(epoch).bytesize <= 4096
+            raise ValidationError, "context epoch scope differs"
+          end
+          true
+        rescue KeyError, TypeError, ArgumentError
+          raise ValidationError, "context epoch is malformed"
+        end
+
+        def initialize(installation:, manager:, configuration:, kernel: Ace::Runtime::Molecules::ProtectedLinux.new,
+          cgroups: Ace::Runtime::Molecules::CgroupObservation.new, files: KernelFiles.new)
+          unless installation.is_a?(Ace::Runtime::Molecules::ExecutionUnitInstallation) &&
+              configuration.is_a?(InboxContextServiceConfiguration)
+            raise ValidationError, "context lifetime selection is not held"
+          end
+          @installation, @manager, @configuration, @kernel, @cgroups, @files = installation, manager, configuration, kernel, cgroups, files
+          unless installation.inbox_context_configuration_reference == configuration.reference
+            raise ValidationError, "context lifetime configuration association differs"
+          end
+        end
+
+        def capture_epoch!
+          raise ValidationError, "context epoch is already observed" if @epoch
+          scope = @installation.inbox_context_scope
+          @installation.verify!(manager: @manager)
+          boot = @files.boot_id
+          before = @manager.inspect_activation.fetch("service")
+          peer = @kernel.capture(Process.pid)
+          unless peer.values_at("uid", "gid", "groups") == @configuration.data.fetch("owner_credentials").values_at("uid", "gid", "groups") &&
+              before.fetch("Id") == scope.fetch("service_unit") && before.fetch("MainPID") == Process.pid &&
+              before.fetch("ControlPID").zero? && before.fetch("Job") == [0, "/"] &&
+              before.fetch("ActiveState") == "active" && before.fetch("SubState") == "running" &&
+              before.fetch("InvocationID").is_a?(String) && before.fetch("InvocationID").match?(/\A[0-9a-f]{32}\z/)
+            raise ValidationError, "context service incarnation differs"
+          end
+          path = Ace::Runtime::Molecules::CgroupObservation::ROOT + before.fetch("ControlGroup")
+          pinned = @cgroups.pin(path)
+          @cgroups.member!(peer, pinned: pinned, kernel: @kernel)
+          unless @cgroups.observe(pinned).fetch("populated") == 1 && @kernel.same?(peer, @kernel.capture(Process.pid)) &&
+              @manager.inspect_activation.fetch("service") == before && @files.boot_id == boot
+            raise ValidationError, "context service observation changed"
+          end
+          @installation.verify!(manager: @manager)
+          observed = {"schema" => "ace.herdr.inbox-owner-epoch/v1", "installation_sha256" => scope.fetch("unit_manifest_sha256"),
+            "boot_id" => boot, "service_unit" => scope.fetch("service_unit"), "service_invocation_id" => before.fetch("InvocationID"),
+            "cgroup_identity" => pinned.fetch(:identity), "process_identity" => peer}
+          self.class.validate_epoch!(observed)
+          @epoch = immutable(observed)
+        rescue KeyError, TypeError, Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+          raise ValidationError, "context service epoch is unavailable"
+        ensure
+          pinned&.fetch(:handle)&.close
+        end
+
+        private
+
+        def immutable(value)
+          case value
+          when Hash then value.to_h { |key, item| [key.dup.freeze, immutable(item)] }.freeze
+          when Array then value.map { |item| immutable(item) }.freeze
+          when String then value.dup.freeze
+          else value.freeze
+          end
+        end
+      end
+    end
+  end
+end

data/lib/ace/herdr/molecules/inbox_context_native_process.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "ace/runtime/molecules/protected_artifact_set"
+require_relative "inbox_context_service_configuration"
+require_relative "bounded_process"
+
+module Ace
+  module Herdr
+    module Molecules
+      # Exact accepted executable inode, fixed environment and startup closure.
+      # This is process construction, not original-target authorization.
+      class InboxContextNativeProcess
+        def initialize(configuration:, artifacts_factory: nil, process: BoundedProcess)
+          unless configuration.is_a?(InboxContextServiceConfiguration)
+            raise ValidationError, "context native selection is not held"
+          end
+          @selection = configuration.data.fetch("native_clients")
+          @credentials = configuration.data.fetch("owner_credentials")
+          @artifacts_factory = artifacts_factory || -> { Ace::Runtime::Molecules::ProtectedArtifactSet.new(
+            file_limit: 268_435_456, total_limit: 268_435_456, count_limit: 512) }
+          @process = process
+        end
+
+        def verify!
+          @artifacts_factory.call.with do |reader|
+            references.each { |ref| reader.read!(ref) }
+            @selection.values_at("codex", "pi", "herdr").each do |ref|
+              reader.with_readonly_handle!(ref) { |handle| verify_executable!(handle) }
+            end
+            resource_snapshot!
+            reader.verify_unchanged!
+          end
+          true
+        rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+          raise ValidationError, "context native release is unavailable"
+        end
+
+        def call(argv, stdin_data:, timeout_s:, output_limit: 65_536)
+          selected = @selection.values_at("codex", "pi", "herdr").find { |ref| ref.fetch("path") == argv.first }
+          raise ValidationError, "context native executable is not selected" unless selected
+          @artifacts_factory.call.with do |reader|
+            references.each { |ref| reader.read!(ref) }
+            resources = resource_snapshot!
+            reader.with_readonly_handle!(selected) do |handle|
+              verify_executable!(handle)
+              result = @process.call(["/proc/self/fd/5", *argv.drop(1)], stdin_data: stdin_data, timeout_s: timeout_s,
+                output_limit: output_limit, environment: @selection.fetch("environment"),
+                chdir: @selection.fetch("cwd"), descriptor_mapping: {5 => handle})
+              raise ValidationError, "context native resource changed" unless resource_snapshot! == resources
+              result
+            end
+          end
+        rescue Ace::Runtime::RuntimeUnavailableError, SystemCallError, IOError
+          raise ValidationError, "context native executable evidence is unavailable"
+        end
+
+        private
+
+        def references = @selection.values_at("codex", "pi", "herdr") + @selection.fetch("dependencies")
+
+        def access_bits(stat)
+          if stat.uid == @credentials.fetch("uid")
+            (stat.mode >> 6) & 7
+          elsif (@credentials.fetch("groups") + [@credentials.fetch("gid")]).include?(stat.gid)
+            (stat.mode >> 3) & 7
+          else
+            stat.mode & 7
+          end
+        end
+
+        def verify_executable!(handle)
+          raise ValidationError, "context native executable mode differs" unless (access_bits(handle.stat) & 1) == 1
+        end
+
+        def resource_snapshot!
+          @selection.fetch("resources").map do |row|
+            stat = File.lstat(row.fetch("path"))
+            kind = row.fetch("kind") == "directory" ? stat.directory? : stat.socket?
+            unless kind && !stat.symlink? && stat.uid == row.fetch("uid") && stat.gid == row.fetch("gid") &&
+                (stat.mode & 0o7777) == row.fetch("mode")
+              raise ValidationError, "context native resource placement differs"
+            end
+            bits = access_bits(stat)
+            required = row.fetch("kind") == "socket" ? 2 : row.fetch("access") == "write" ? 3 : 5
+            raise ValidationError, "context native resource access differs" unless (bits & required) == required
+            [stat.dev, stat.ino, stat.uid, stat.gid, stat.mode]
+          end
+        end
+      end
+    end
+  end
+end